BUGTRAQ: FAQ

★ wanayoo — archive 1999 http://www.securityfocus.com/forums/bugtraq/faq.html

BugTraq
Frequently Asked Questions

0 Administrivia

0.1 Charter
0.1.1 What is BugTraq?
0.1.2 What is appropriate content?
0.1.3 What is inappropriate content?
0.1.4 Is the list moderated?
0.1.5 Who is the moderator?
0.1.6 What is Full Disclosure?
0.1.7 What is Security Through Obscurity?
0.1.8 What is the proper protocol to report a security vulnerability?
0.1.9 What should be included in a vulnerability report?

0.2 History
0.2.1 When was BugTraq created?
0.2.2 When did BugTraq become moderated?

0.3 List Management
0.3.1 How do I subscribe?
0.3.2 How do I unsubscribe?
0.3.3 How do I disable mail delivery temporarily?
0.3.4 Is the list available in a digest format?
0.3.5 How do I subscribe to the digest?
0.3.6 How do I unsubscribe from the digest?
0.3.7 I seem to not be able to unsubscribe. What is going on?
0.3.8 Can you add a tag like "[BUGTRAQ]" to the subject line of each message?
0.3.9 Why does LISTSERV not respond to any of my commands?

0 Administrivia
0.1 Charter
0.1.1 What is BugTraq?

BugTraq is a full disclosure moderated mailing list for the *detailed* discussion and announcement of computer security vulnerabilities: what they are, how to exploit them, and how to fix them.

0.1.2 What is appropriate content?

Please follow the below guidelines on what kind of information should be posted to the Bugtraq list:

Information on computer or network related security vulnerabilities (UNIX, Windows NT, or any other).
Exploit programs, scripts or detailed processes about the above.
Patches, workarounds, fixes.
Announcements, advisories or warnings.
Ideas, future plans or current works dealing with computer/network security.
Information material regarding vendor contacts and procedures.
Individual experiences in dealing with above vendors or security organizations.
Incident advisories or informational reporting.
New or updated security tools.

0.1.3 What is inappropriate content?

Product advertisements.
Basic "how to" questions.
Non-computer/network security related material.
Information about yet another trojan or virus, unless is it widely deployed in the wild.

0.1.4 Is the list moderated?

Yes.

0.1.5 Who is the moderator?

Yours truly, Elias Levy a.k.a. Aleph One. You can reach me at aleph1@securityfocus.com.

0.1.6 What is Full Disclosure?

Full Disclosure is a security philosophy that believes:

A truly secure system must be able to withstand open review at all levels (e.g. protocol, source code, etc).
The details of security vulnerabilities should be available to everyone.

Benefits include:

A large number of individuals get to review the system for security weaknesses.
Vendors are pressured into providing security fixes quickly.
Programmers and system designers can learn from others mistakes.
Users can identify similar vulnerabilities on systems other than the original.

Cons include:

At the same time you inform constructive people of security vulnerabilities, you also inform destructive people.

0.1.7 What is Security Through Obscurity?

Security Through Obscurity is a security philosophy that believes:

Thats if the details of a system are not made publicly available the system will be more secure.
Vulnerability details should be restricted to vendors and a few security experts.

0.1.8 What is the proper protocol to report a security vulnerability?

A sensible protocol to follow while reporting a security vulnerability is as follows:

Contact the product's vendor or maintainer and give them a one week period to respond. If they don't respond post to the list.
If you do hear from the vendor give them what you consider appropriate time to fix the vulnerability. This will depend on the vulnerability and the product. It's up to you to make and estimate. If they don't respond in time post to the list.
If the contact you asking for more time consider extending the deadline in good faith. If they continually fail to meet the deadline post to the list.

When is it advisable to post to the list without contacting the vendor?

When the product is no longer actively supported.
When you believe the vulnerability to be actively exploited and not informing the community as soon as possible would cause more harm then good.

All this being said, we rather have people report vulnerabilities to the list and not inform the vendors, whatever their reasons may be, than to have them keep the information to themselves.

0.1.9 What should be included in a vulnerability report?

A list of vulnerable applications/operating systems/device/etc with version numbers and patch levels.
A list of non-vulnerable applications/operating systems/devices/etc with version numbers and patch levels.
A detailed discussion of the vulnerability and the environment in which it was found.
A detailed discussion on how to reproduce the vulnerability, possibly including exploit programs.
A detailed discussion of solutions, fixes or possible work-arounds.
References to information related to the vulnerability.
Appropriate credit if the vulnerability was found by someone else.

0.2 History
0.2.1 When was BugTraq created?

BugTraq was created on Friday the 5th of November, 1993 by Scott Chasin. Aleph One took over BugTraq on Tuesday the 14th of May, 1996. Over the years BugTraq has grown into a well respected security mailing list with over twenty seven thousand subscribers.

0.2.2 When did BugTraq become moderated?

BugTraq became moderated on the 5th of June, 1995. At the same time BugTraq was moved to netspace.org. The list became moderated after the noise level became unacceptable.

0.3 List Management
0.3.1 How do I subscribe?

Send an e-mail message to LISTSERV@SECURITYFOCUS.COM with a message body of:

SUBSCRIBE BUGTRAQ Lastname, Firstname

You will receive a confirmation request message to which you will have to answer.

0.3.2 How do I unsubscribe?

Send an e-mail message to LISTSERV@SECURITYFOCUS.COM from the subscribed address with a message body of:

UNSUBSCRIBE BUGTRAQ

You will receive a confirmation request message to which you will have to answer.

If your email address has changed email listadmin@securityfocus.com and I will manually remove you.

0.3.3 How do I disable mail delivery temporarily?

If you will are simply going in vacation you can turn off mail delivery without unsubscribing by sending LISTSERV the command:

SET BUGTRAQ NOMAIL

You will receive a confirmation request message to which you will have to answer.

To turn back on e-mail delivery use the command:

SET BUGTRAQ MAIL

0.3.4 Is the list available in a digest format?

Yes. The digest generated once a day.

0.3.5 How do I subscribe to the digest?

To subscribe to the digest join the list normally (see section 0.3.1) and then send a message to LISTSERV@SECURITYFOCUS.COM with with a message body of:

SET BUGTRAQ DIGEST

You will receive a confirmation request message to which you will have to answer.

0.3.6 How do I unsubscribe from the digest?

To turn the digest off send a message to LISTSERV with a message body of:

SET BUGTRAQ NODIGEST

You will receive a confirmation request message to which you will have to answer.

If you want to unsubscribe from the list completely follow the instructions of section 0.3.2 next.

0.3.7 I seem to not be able to unsubscribe. What is going on?

You are probably subscribed from a different address than that from which you are sending commands to LISTSERV from. Either send email from the appropriate address or email the moderator to be unsubscribed manually.

0.3.8 Can you add a tag like "[BUGTRAQ]" to the subject line of each message?

You can set your LISTSERV options to do this for your subscription. To do so email LISTSERV@SECURITYFOCUS.COM with a message body of:

SET BUGTRAQ SUBJ

0.3.9 Why does LISTSERV not respond to any of my commands?

The likely reason is that the messages you are sending contains a Sender mail header and that it does not match your From mail header. LISTSERV gives higher priority to the Sender header and will use the address listed there to send back its replied.